1

I was going through the integration documents of a payment processor, and as per my understanding of the code, docs and disassembly, they are doing the following:

  1. Encrypting the CVV on the server-side
  2. Returning half of the ciphertext to the client
  3. Allowing the client to store the partial ciphertext

On further payments, they ask for the partial ciphertext, and allow the payment to pass through without asking for CVV again.

The PCI Doc mentions the following for CVV:

3.2.d For all other entities, if sensitive authentication data is received, review procedures and examine the processes for securely deleting the data to verify that the data is unrecoverable.

Would splitting the CVV and then storing it qualify for "unrecoverable", since both parts individually cannot be used to recover the original? Or would this count as a violation?

2 Answers 2

1

I am not a QSA, but this is my understanding:

The intent of that rule is that the CVV is only available to send to the issuing bank when the cardholder types it in themselves. If the processor is able to recover the CVV in any way which would let them send it without the cardholder entering it, then that is a violation.

By itself, encrypting and splitting the encrypted data is not a problem. However, if you are able to submit your half and recombine it with their half, then that is recoverable. And since there would be no point in this process if you weren't able to submit your half, then the whole thing is, in fact, a violation.

-1

The CVV belongs to the card-holder, and only the card-holder.

By itself it is meaningless. With the Credit Card info however, it is considered Cardholder data and must be treated as such.

The role the CVV plays is that the card-holder can use it to prove they and only they possess the Credit Card. This means that in transactions where the CVV was provided, the transaction is non-reputable: meaning that the cardholder cannot dispute they authorized the transaction.

Here's the rub: Merchants want the CVV number because it denies the consumer the right to charge-back. But in card-not-present transactions the merchant doesn't in fact have the card or the CVV number available to them so they ask for it.

Merchants have no right to ask for a CVV number since it's purpose is to verify card possession and not authorize transactions. Consumers have the right to refuse to give it.

Answer: The only place the CVV number should be stored is on the card itself.

2
  • This is not true. You always have the right to dispute a charge on your card. The CVV just makes it easier for the merchant to claim it is a legitimate charge.
    – Bobson
    Feb 17, 2017 at 15:59
  • It is true. The purpose of the CVV is to validate that the card was present at the time of transaction. I didn't argue you lost that right. I argued you wouldn't win.
    – user34445
    Feb 17, 2017 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .